The "user" directory is special: you don't need "access" to download from it.

When sending a user-to-user file transfer, SBBS (since v3.19) will check that
the file recipient will be able to download it (e.g. doesn't have restrictions
preventing it) and this was failing for most (non-sysop) recipient users since
they wouldn't normally meet the "access restrictions" of the user directory
(by design).